FM / lwtools

/usr/share/systemtap/examples/lwtools

Name	Size	Mode	Actions
accept2close-nd.8	1424	0644	edit dl rm
accept2close-nd.meta	597	0644	edit dl rm
accept2close-nd.stp	1798	0755	edit dl rm
accept2close-nd.txt	3385	0644	edit dl rm
biolatency-nd.8	1671	0644	edit dl rm
biolatency-nd.meta	622	0644	edit dl rm
biolatency-nd.stp	2071	0755	edit dl rm
biolatency-nd_example.txt	7362	0644	edit dl rm
bitesize-nd.8	1157	0644	edit dl rm
bitesize-nd.meta	491	0644	edit dl rm
bitesize-nd.stp	1543	0755	edit dl rm
bitesize-nd_example.txt	3426	0644	edit dl rm
execsnoop-nd.8	1235	0644	edit dl rm
execsnoop-nd.meta	570	0644	edit dl rm
execsnoop-nd.stp	1283	0755	edit dl rm
execsnoop-nd_example.txt	2585	0644	edit dl rm
fslatency-nd.8	1930	0644	edit dl rm
fslatency-nd.meta	660	0644	edit dl rm
fslatency-nd.stp	3982	0755	edit dl rm
fslatency-nd_example.txt	13384	0644	edit dl rm
fsslower-nd.8	1753	0644	edit dl rm
fsslower-nd.meta	623	0644	edit dl rm
fsslower-nd.stp	3715	0755	edit dl rm
fsslower-nd_example.txt	1938	0644	edit dl rm
killsnoop-nd.8	1131	0644	edit dl rm
killsnoop-nd.meta	384	0644	edit dl rm
killsnoop-nd.stp	1281	0755	edit dl rm
killsnoop-nd_example.txt	1908	0644	edit dl rm
opensnoop-nd.8	1268	0644	edit dl rm
opensnoop-nd.meta	357	0644	edit dl rm
opensnoop-nd.stp	1026	0755	edit dl rm
opensnoop-nd_example.txt	1124	0644	edit dl rm
README	107	0644	edit dl rm
rwtime-nd.8	1146	0644	edit dl rm
rwtime-nd.meta	412	0644	edit dl rm
rwtime-nd.stp	1599	0755	edit dl rm
rwtime-nd_example.txt	4185	0644	edit dl rm
syscallbypid-nd.8	1089	0644	edit dl rm
syscallbypid-nd.meta	404	0644	edit dl rm
syscallbypid-nd.stp	1100	0755	edit dl rm
syscallbypid-nd_example.txt	9322	0644	edit dl rm

Edit: /usr/share/systemtap/examples/lwtools/execsnoop-nd_example.txt (2585B)

Examples of execsnoop-nd.stp, the Linux SystemTap version.

Tracing while "man ls" was executed:

# ./execsnoop-nd.stp 
TIME                        UID   PPID    PID           COMM ARGS
Sat Jan 31 00:56:02 2015      0  11962  13472            man man ls
Sat Jan 31 00:56:02 2015      0  13472  13473             sh sh -c /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13473         gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13473           gzip gzip -d -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13474             sh sh -c /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13474         gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13474           gzip gzip -d -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13472  13475             sh sh -c (cd "/usr/share/man" && (echo ".ll 15.5i"; echo ".nr LL 15.5i"; echo ".pl 1100i"; /usr/bin/gunzip -c '/usr/share/man/man1/ls.1.gz'; echo ".\\\""; echo ".pl \n(nlu+10") | /usr/bin/gtbl | /usr/bin/nroff -c -mandoc 2>/dev/null | /usr/bin/less -is)
Sat Jan 31 00:56:02 2015      0  13476  13479          nroff /bin/bash /usr/bin/nroff -c -mandoc
Sat Jan 31 00:56:02 2015      0  13476  13481           less /usr/bin/less -is
Sat Jan 31 00:56:02 2015      0  13476  13478           gtbl /usr/bin/gtbl
Sat Jan 31 00:56:02 2015      0  13477  13480         gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13477  13480           gzip gzip -d -c /usr/share/man/man1/ls.1.gz
Sat Jan 31 00:56:02 2015      0  13482  13483         locale locale charmap
Sat Jan 31 00:56:02 2015      0  13484  13485         mktemp mktemp /tmp/man.XXXXXX
Sat Jan 31 00:56:02 2015      0  13479  13486            cat cat
Sat Jan 31 00:56:02 2015      0  13479  13487          iconv iconv -f utf-8 -t utf-8 /tmp/man.OGU85G
Sat Jan 31 00:56:02 2015      0  13479  13488             rm rm -f /tmp/man.OGU85G
Sat Jan 31 00:56:02 2015      0  13476  13479          groff /usr/bin/groff -mtty-char -P-c -mandoc -Tutf8
Sat Jan 31 00:56:02 2015      0  13479  13489          troff troff -mtty-char -mandoc -Tutf8
Sat Jan 31 00:56:02 2015      0  13479  13490         grotty grotty -c

The output shows all the exec() syscall, which is a rough way to examine new
process execution. Some of these processes have called exec() more than once;
also, some new process that only fork() won't be seen.

Examples of execsnoop-nd.stp, the Linux SystemTap version. Tracing while "man ls" was executed: # ./execsnoop-nd.stp TIME UID PPID PID COMM ARGS Sat Jan 31 00:56:02 2015 0 11962 13472 man man ls Sat Jan 31 00:56:02 2015 0 13472 13473 sh sh -c /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13472 13473 gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13472 13473 gzip gzip -d -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13472 13474 sh sh -c /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13472 13474 gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13472 13474 gzip gzip -d -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13472 13475 sh sh -c (cd "/usr/share/man" && (echo ".ll 15.5i"; echo ".nr LL 15.5i"; echo ".pl 1100i"; /usr/bin/gunzip -c '/usr/share/man/man1/ls.1.gz'; echo ".\\\""; echo ".pl \n(nlu+10") | /usr/bin/gtbl | /usr/bin/nroff -c -mandoc 2>/dev/null | /usr/bin/less -is) Sat Jan 31 00:56:02 2015 0 13476 13479 nroff /bin/bash /usr/bin/nroff -c -mandoc Sat Jan 31 00:56:02 2015 0 13476 13481 less /usr/bin/less -is Sat Jan 31 00:56:02 2015 0 13476 13478 gtbl /usr/bin/gtbl Sat Jan 31 00:56:02 2015 0 13477 13480 gunzip /bin/sh /usr/bin/gunzip -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13477 13480 gzip gzip -d -c /usr/share/man/man1/ls.1.gz Sat Jan 31 00:56:02 2015 0 13482 13483 locale locale charmap Sat Jan 31 00:56:02 2015 0 13484 13485 mktemp mktemp /tmp/man.XXXXXX Sat Jan 31 00:56:02 2015 0 13479 13486 cat cat Sat Jan 31 00:56:02 2015 0 13479 13487 iconv iconv -f utf-8 -t utf-8 /tmp/man.OGU85G Sat Jan 31 00:56:02 2015 0 13479 13488 rm rm -f /tmp/man.OGU85G Sat Jan 31 00:56:02 2015 0 13476 13479 groff /usr/bin/groff -mtty-char -P-c -mandoc -Tutf8 Sat Jan 31 00:56:02 2015 0 13479 13489 troff troff -mtty-char -mandoc -Tutf8 Sat Jan 31 00:56:02 2015 0 13479 13490 grotty grotty -c The output shows all the exec() syscall, which is a rough way to examine new process execution. Some of these processes have called exec() more than once; also, some new process that only fork() won't be seen.